move stored_secret from swarm-queue-client to swarm-secret-client

The module is a rename (97% similar); everything else in the diff follows
from the move:

- stored_secret.rs: private `chain()` helper, the 8-line copy of the queue
  crate's `chain` the module called as `crate::chain`; the queue crate's
  public `chain` stays.
- stored_secret.rs: `Duration::from_mins(5)` in `MAX_REREAD_DELAY` is
  unchanged moved code, not a new use.
- swarm-secret-client Cargo.toml: gains futures-util, tokio and tracing as
  dependencies and tokio `test-util` plus tracing-subscriber as dev
  dependencies; the module and its tests use them.
- swarm-queue-client Cargo.toml: drops futures-util and the tracing-subscriber
  dev dependency, which only the moved module used; its tokio dev comment is
  reworded to the tests that remain.
- Cargo.lock: the same dependency moves, nothing else.
- swarm-queue-client lib.rs: imports `swarm_secret_client::stored_secret`,
  and its tests use a small local `Store` in place of the moved module's
  test-only `Fake`, which is no longer reachable.
- callers (hive-c0re, swarm-builder, swarm-ci-metrics, swarm-claude-login,
  swarm-controller, swarm-nats-auth, swarm-review-classifier): import path
  only; no re-export is left behind.

swarm-controller/src/forge.rs

@@ -42,7 +42,7 @@ use utoipa::ToSchema;
 
 use crate::webhook::DeliveryKind;
 use swarm_queue_client::review_classifier::Commit;
-use swarm_queue_client::stored_secret::StoredSecret;
+use swarm_secret_client::stored_secret::StoredSecret;
 
 pub mod agent_token;
 mod api;

swarm-controller/src/forge/api.rs

@@ -12,7 +12,7 @@ use std::sync::{Arc, Mutex};
 use forgejo_api::{ApiErrorKind, Auth, Forgejo, ForgejoError};
 use futures_util::future::BoxFuture;
 use reqwest::StatusCode;
-use swarm_queue_client::stored_secret::StoredSecret;
+use swarm_secret_client::stored_secret::StoredSecret;
 
 /// One forge request, as [`Api::call`] runs it.
 pub(crate) type Call<'a, R> = BoxFuture<'a, Result<R, ForgejoError>>;

swarm-controller/src/queue_identity.rs

@@ -5,7 +5,7 @@
 //! environment. The client secret comes from the swarm's secret store, at
 //! `swarm_secret_client::queue::controller_client_path`, read at start under
 //! this daemon's own certificate, held only in memory and read again when
-//! authelia refuses it (`swarm_queue_client::stored_secret`). It is never on
+//! authelia refuses it (`swarm_secret_client::stored_secret`). It is never on
 //! this host's disk. `swarm-secret-publish`, in authelia's
 //! container, puts it there.
 //!
@@ -15,9 +15,9 @@ use std::path::PathBuf;
 use std::sync::OnceLock;
 
 use anyhow::{Context, Result, bail};
-use swarm_queue_client::stored_secret::StoredSecret;
 use swarm_queue_client::{ClientSecret, QueueConfig};
 use swarm_secret_client::queue::{self, ControllerCredential};
+use swarm_secret_client::stored_secret::StoredSecret;
 
 /// The environment prefix the nix module's `queueEnv` sets.
 const PREFIX: &str = "SWARM_CONTROLLER";